CVE-2025-24998

HIGH 7.3CVE-2025-24998 · Published 11/03/2025 · updated 17/06/2026

In short

CVE-2025-24998 is a HIGH (CVSS 7.3) vulnerability affecting visual studio 2017 (microsoft), visual studio 2019 (microsoft), visual studio 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 39.6% of all vulnerabilities.
Fix: update to 15.9.71, 16.11.45, 17.10.12, 17.12.6 or later.

Package	Affected versions	Patched versions
visual studio 2017 microsoft	`≥ 15.0, < 15.9.71`	`15.9.71`
visual studio 2019 microsoft	`≥ 16.0, < 16.11.45`	`16.11.45`
visual studio 2022 microsoft	`≥ 17.10.0, < 17.10.12≥ 17.12.0, < 17.12.6≥ 17.13.0, < 17.13.3≥ 17.8.0, < 17.8.19`	`17.10.1217.12.617.13.317.8.19`

Description

Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24998 · Vendor Advisory

More vulnerabilities in visual studio 2017

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2025-24998 is a HIGH (CVSS 7.3) vulnerability affecting visual studio 2017 (microsoft), visual studio 2019 (microsoft), visual studio 2022 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 39.6% of all vulnerabilities.

Fix: update to 15.9.71, 16.11.45, 17.10.12, 17.12.6 or later.

Package

Affected versions

Patched versions

visual studio 2017

microsoft

≥ 15.0, < 15.9.71

15.9.71

visual studio 2019

microsoft

≥ 16.0, < 16.11.45

16.11.45

visual studio 2022

microsoft

≥ 17.10.0, < 17.10.12≥ 17.12.0, < 17.12.6≥ 17.13.0, < 17.13.3≥ 17.8.0, < 17.8.19

17.10.1217.12.617.13.317.8.19

More vulnerabilities in visual studio 2017

See all →